This vulnerability affects the Helidon component of Oracle Fusion Middleware (Imperative Web Server). It is exploitable remotely without authentication over HTTP, enabling attackers to compromise Helidon and potentially impact additional products. Successful exploitation can lead to unauthorized data manipulation (update, insert, delete), unauthorized data disclosure (read access), and partial denial of service conditions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and low to partial impacts on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update addresses this and many other vulnerabilities, recommending customers apply patches promptly.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized read and write access to some Helidon data and cause a partial denial of service. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond Helidon.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to affected Helidon versions (4.0.0 through 4.5.2 and 4.5.3). Oracle strongly recommends remaining on actively supported versions and applying security updates without delay. No alternative mitigations or 'no action required' statements are provided by the vendor advisory.